diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2020-04-01 00:08:09 +0000 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2020-04-01 00:08:09 +0000 |
commit | 396ad86100541bed6bc9960541a7dcddfaddd6de (patch) | |
tree | 65f131996352948dbeb09d7ccd56107561c08fe3 /doc/user/application_security | |
parent | abae8f34f377519946a91101ef7abf504454531c (diff) | |
download | gitlab-ce-396ad86100541bed6bc9960541a7dcddfaddd6de.tar.gz |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'doc/user/application_security')
-rw-r--r-- | doc/user/application_security/container_scanning/index.md | 5 | ||||
-rw-r--r-- | doc/user/application_security/dast/index.md | 4 | ||||
-rw-r--r-- | doc/user/application_security/index.md | 6 | ||||
-rw-r--r-- | doc/user/application_security/offline_deployments/index.md | 27 | ||||
-rw-r--r-- | doc/user/application_security/sast/index.md | 2 |
5 files changed, 27 insertions, 17 deletions
diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md index 227647ae785..d1ded52585e 100644 --- a/doc/user/application_security/container_scanning/index.md +++ b/doc/user/application_security/container_scanning/index.md @@ -209,13 +209,14 @@ If you want to whitelist specific vulnerabilities, you'll need to: in the [whitelist example file](https://github.com/arminc/clair-scanner/blob/v12/example-whitelist.yaml). 1. Add the `clair-whitelist.yml` file to the Git repository of your project. -### Running Container Scanning in an offline, air-gapped installation +### Running Container Scanning in an offline environment deployment -Container Scanning can be executed on an offline air-gapped GitLab Ultimate installation using the following process: +Container Scanning can be executed on an offline GitLab Ultimate installation by using the following process: 1. Host the following Docker images on a [local Docker container registry](../../packages/container_registry/index.md): - [arminc/clair-db vulnerabilities database](https://hub.docker.com/r/arminc/clair-db) - GitLab klar analyzer: `registry.gitlab.com/gitlab-org/security-products/analyzers/klar` + 1. [Override the container scanning template](#overriding-the-container-scanning-template) in your `.gitlab-ci.yml` file to refer to the Docker images hosted on your local Docker container registry: ```yaml diff --git a/doc/user/application_security/dast/index.md b/doc/user/application_security/dast/index.md index af8c6a3feb0..c47cbfa9aa8 100644 --- a/doc/user/application_security/dast/index.md +++ b/doc/user/application_security/dast/index.md @@ -442,9 +442,9 @@ dast: The DAST job does not require the project's repository to be present when running, so by default [`GIT_STRATEGY`](../../../ci/yaml/README.md#git-strategy) is set to `none`. -## Running DAST in an offline air-gapped installation +## Running DAST in an offline environment deployment -DAST can be executed on an offline air-gapped GitLab Ultimate installation using the following process: +DAST can be executed on an offline GitLab Ultimate installation by using the following process: 1. Host the DAST image `registry.gitlab.com/gitlab-org/security-products/dast:latest` in your local Docker container registry. diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md index e1056eb2002..299507ff6c4 100644 --- a/doc/user/application_security/index.md +++ b/doc/user/application_security/index.md @@ -226,7 +226,7 @@ must be created with the case-sensitive name `License-Check`. This approval grou with the number of approvals required greater than zero. Once this group is added to your project, the approval rule is enabled for all Merge Requests. To -configure how this rule behaves, you can choose which licenses to `approve` or `blacklist` in the +configure how this rule behaves, you can choose which licenses to `allow` or `deny` in the [project policies for License Compliance](../compliance/license_compliance/index.md#project-policies-for-license-compliance) section. @@ -234,13 +234,13 @@ Any code changes cause the approvals required to reset. An approval is required when a license report: -- Contains a dependency that includes a software license that is `blacklisted`. +- Contains a dependency that includes a software license that is `denied`. - Is not generated during pipeline execution. An approval is optional when a license report: - Contains no software license violations. -- Contains only new licenses that are `approved` or unknown. +- Contains only new licenses that are `allowed` or unknown. ## Working in an offline environment diff --git a/doc/user/application_security/offline_deployments/index.md b/doc/user/application_security/offline_deployments/index.md index c8161b2ef33..e548d2128b4 100644 --- a/doc/user/application_security/offline_deployments/index.md +++ b/doc/user/application_security/offline_deployments/index.md @@ -2,17 +2,26 @@ type: reference, howto --- -# Air-gapped (or offline) environment deployments +# Offline environment deployments It is possible to run most of the GitLab security scanners when not connected to the internet. -This document describes how to operate Secure scanners in an air-gapped or offline envionment. These instructions also apply to -self-managed installations that are secured, have security policies (e.g., firewall policies), or otherwise restricted from -accessing the full internet. These instructions are designed for physically disconnected networks, -but can also be followed in these other use cases. +This document describes how to operate Secure Categories (that is, scanner types) in an offline environment. These instructions also apply to +self-managed installations that are secured, have security policies (for example, firewall policies), or are otherwise restricted from +accessing the full internet. GitLab refers to these deployments as _offline environment deployments_. +Other common names include: -## Air-gapped (or offline) environments +- Air-gapped environments +- Limited connectivity environments +- Local area network (LAN) environments +- Intranet environments + +These environments have physical barriers or security policies (for example, firewalls) that prevent +or limit internet access. These instructions are designed for physically disconnected networks, but +can also be followed in these other use cases. + +## Offline environments In this situation, the GitLab instance can be one or more servers and services that can communicate on a local network, but with no or very restricted access to the internet. Assume anything within @@ -64,6 +73,6 @@ hosted within your network. Each individual scanner may be slightly different than the steps described above. You can find more info at each of the pages below: -- [Container scanning offline directions](../container_scanning/index.md#running-container-scanning-in-an-offline-air-gapped-installation) -- [SAST offline directions](../sast/index.md#gitlab-sast-in-an-offline-air-gapped-installation) -- [DAST offline directions](../dast/index.md#running-dast-in-an-offline-air-gapped-installation) +- [Container scanning offline directions](../container_scanning/index.md#running-container-scanning-in-an-offline-environment-deployment) +- [SAST offline directions](../sast/index.md#gitlab-sast-in-an-offline-environment-deployment) +- [DAST offline directions](../dast/index.md#running-dast-in-an-offline-environment-deployment) diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md index 5991fe8cf01..7d9717b049d 100644 --- a/doc/user/application_security/sast/index.md +++ b/doc/user/application_security/sast/index.md @@ -491,7 +491,7 @@ Once a vulnerability is found, you can interact with it. Read more on how to For more information about the vulnerabilities database update, check the [maintenance table](../index.md#maintenance-and-update-of-the-vulnerabilities-database). -## GitLab SAST in an offline air-gapped installation +## GitLab SAST in an offline environment deployment For self-managed GitLab instances in an environment with limited, restricted, or intermittent access to external resources via the internet, some adjustments are required for the SAST job to |